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IN THE CLAIMS 

Please amend the claims as follows: 

1-48. (canceled) 

49. (new) An apparatus comprising: 
a processor; and 

a storage device connected to the processor, wherein the storage device has stored 
thereon a program, wherein the processor is operative to execute instructions of the 
program to implement a method comprising the steps of: 

updating, at successive update times, virus definitions for resources stored 
on a data processing system; 

scanning the resources for viruses in first and second scanning instances 
responsive to the virus definitions updated at respective first and second ones of 
the update times; 

computing hash values for the resources at the first and second update 

times; 

classifying each of the resources as higher or lower priority responsive to 
whether the hash values for each resource are equal for the first and second update 
times and whether the scanning determines each resource is virus free in both the 
first and second scanning instances; 

updating the virus definitions at a next update time; and 
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scanning resources for viruses in a next scanning instance responsive to the 
virus definitions updated at the next time, wherein in the next scanning instance 
the ones of the resources classified as higher priority are scanned before the ones 
of the resources classified as lower priority. 

50. (new) The apparatus of claim 49, wherein the data processing system has 
activity intervals of higher and lower activity and in the next scanning instance the 
scanning of the ones of the resources classified as lower priority is performed during one 
of the lower activity intervals. 

51. (new) The apparatus of claim 49, wherein a scanning interval is defined from a 
time of the first scanning instance until a time of the second scanning instance and the 
classifying is further responsive to whether the scanning interval exceeds a predetermined 
threshold. 

52. (new) The apparatus of claim 49, wherein in the next scanning instance the 
ones of the resources classified as lower priority are not scanned. 
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53. (new) A method comprising the steps of: 

updating, at successive update times, virus definitions for resources stored on a 
data processing system; 

scanning the resources for viruses in first and second scanning instances 
responsive to the virus definitions updated at respective first and second ones of the 
update times; 

computing hash values for the resources at the first and second update times; 

classifying each of the resources as higher or lower priority responsive to whether 
the hash values for each resource are equal for the first and second update times and 
whether the scanning determines each resource is virus free in both the first and second 
scanning instances; 

updating the virus definitions at a next update time; and 

scanning the resources for viruses in a next scanning instance responsive to the 
virus definitions updated at the next time, wherein in the next scanning instance the ones 
of the resources classified as higher priority are scanned before the ones of the resources 
classified as lower priority. 
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54. (new) The method of claim 53, wherein the data processing system has activity 
intervals of higher and lower activity and in the next scanning instance the scanning of the 
ones of the resources classified as lower priority is performed during one of the lower 
activity intervals. 

55. (new) The method of claim 53, wherein a scanning interval is defined from a 
time of the first scanning instance until a time of the second scanning instance and the 
classifying is further responsive to whether the scanning interval exceeds a predetermined 
threshold. 

56. (new) The method of claim 53, wherein in the next scanning instance the ones 
of the resources classified as lower priority are not scanned. 
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57. (new) A computer program product stored on a tangible, computer readable 
medium, said computer program product having instructions for execution by a computer 
system, wherein the instructions, when executed by the computer system, cause the 
computer system to implement a method comprising the steps of: 

updating, at successive update times, virus definitions for resources stored on a 
data processing system; 

scanning the resources for viruses in first and second scanning instances 
responsive to the virus definitions updated at respective first and second ones of the 
update times; 

computing hash values for the resources at the first and second update times; 

classifying each of the resources as higher or lower priority responsive to whether 
the hash values for each resource are equal for the first and second update times and 
whether the scanning determines each resource is virus free in both the first and second 
scanning instances; 

updating the virus definitions at a next update time; and 

scanning the resources for viruses in a next scanning instance responsive to the 
virus definitions updated at the next time, wherein in the next scanning instance the ones 
of the resources classified as higher priority are scanned before the ones of the resources 
classified as lower priority. 
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58. (new) The computer program product of claim 57, wherein the data processing 
system has activity intervals of higher and lower activity and in the next scanning instance 
the scanning of the ones of the resources classified as lower priority is performed during 
one of the lower activity intervals. 

59. (new) The computer program product of claim 57, wherein a scanning interval 
is defined from a time of the first scanning instance until a time of the second scanning 
instance and the classifying is further responsive to whether the scanning interval exceeds 
a predetermined threshold. 

60. (new) The computer program product of claim 57, wherein in the next 
scanning instance the ones of the resources classified as lower priority are not scanned. 
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